no, to require client certs and to validate that they got signed by root.pem